CWE-74: Injection
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements in Output Used by a Downstream Component.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- ilias learning management systemILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.php executeQueries sql injection5.1 Medium
- montodel house-rental-managementMontodel House-Rental-Management index.php houses sql injection5.3 Medium
- montodel house-rental-managementMontodel House-Rental-Management login.php sql injection6.9 Medium
- containerdcontainerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull9.4 Critical
- jleehr canto-saas-apicanto-saas-api: Authenticated API requests can be redirected via unencoded path variables4.8 Medium
- open-telemetry github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter, opentelemetry-collector-contrib +1 moreOpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token5.3 Medium
- dadrus heimdallHeimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode7.0 High
- f5 nginx gateway fabricNGINX Gateway Fabric vulnerability8.6 High
- cisco crosswork network controller, crosswork network change automation +1 moreCisco Crosswork Network Controller Remote Code Execution Vulnerability6.3 Medium
- f5 nginx gateway fabricNGINX Gateway Fabric vulnerability8.6 High
- yealink sip-t46uYealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection5.1 Medium
- yealink sip-t46uYealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection5.3 Medium
- ancorathemes gritGrit42 Grit data_table_entity.rb DataTableEntity sql injection5.3 Medium
- ruijie eg105g-pRuijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injection8.6 High
- ancorathemes gritGrit42 Grit GritEntityController grit_entity_controller.rb sql injection5.3 Medium
- gl.inet gl-mt3000GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection8.7 High
- gl.inet gl-mt3000GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection8.7 High
- codeastro student attendance management systemCodeAstro Student Attendance Management System createStudents.php sql injection5.1 Medium
- fedoraproject fedora, red hat enterprise linux 6, enterprise linux 7 +9 more +11 moreAbrt: unsanitized systemd journal content written to dump directory files enables content injection5.5 Medium
- codeastro human resource management systemCodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection5.3 Medium
- yt-dlpyt-dlp: Arbitrary code execution via manifest downloads with aria2c8.3 High
- osgeo geoserver, geoserver org.geoserver.extension:gs-db2 +1 moreGeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection7.2 High
- vim, red hat enterprise linux 10, enterprise linux 10.0 extended update support +9 more +11 moreVim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name7.3 High
- thinkst canarytokensHTML injection in the Canarytoken links email2.0 Low
- frappe learning, lms +1 moreFrappe LMS: HTML injection in user-controlled metadata2.1 Low
- jetbrains runtime, sensiolabs symfony +1 moreSymfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch8.3 High
- microsoft sharepoint server, sharepoint server 2019, sharepoint server subscription edition +2 moreMicrosoft SharePoint Server Spoofing Vulnerability7.3 High
- microsoft teams for android, teams +1 moreMicrosoft Teams for Android Information Disclosure Vulnerability8.1 High
- rapid7 velociraptorA YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7...7.8 High
- codeastro student attendance management systemCodeAstro Student Attendance Management System createClassArms.php sql injection5.3 Medium
- codeastro student attendance management systemCodeAstro Student Attendance Management System createClass.php edit sql injection5.3 Medium
- codeastro student attendance management systemCodeAstro Student Attendance Management System createClass.php sql injection5.3 Medium
- codeastro student attendance management systemCodeAstro Student Attendance Management System index.php sql injection6.9 Medium
- codeastro payroll systemCodeAstro Payroll System view_account.php sql injection5.3 Medium
- codeastro payroll systemCodeAstro Payroll System home_salary.php sql injection5.3 Medium
- imvks786 student management systemimvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection6.9 Medium
- imvks786 student management systemimvks786 student_management_system Login index.ph sql injection6.9 Medium
- designcomputer mysql-mcp-serverdesigncomputer mysql-mcp-server mysql URI server.py read_resource sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System addpatient.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System adminaccount.php sql injection5.3 Medium
- bolt cmsBolt CMS HTML Attribute TextType.php HTML injection5.1 Medium
- codeastro leave management systemCodeAstro Leave Management System add_leave.php sql injection5.3 Medium
- codeastro leave management systemCodeAstro Leave Management System search_staff_for_updation.php sql injection5.3 Medium
- codeastro leave management systemCodeAstro Leave Management System search_staff_to_assign_pc.php sql injection5.3 Medium
- codeastro leave management systemCodeAstro Leave Management System delete_leave_type.php sql injection5.3 Medium
- codeastro leave management systemCodeAstro Leave Management System search_staff_for_deletion.php sql injection5.3 Medium
- sourcecodester hospitals patient records management systemSourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection6.9 Medium
- codeastro ingredients stock management systemCodeAstro Ingredients Stock Management System add_stock.php sql injection5.3 Medium
- code-projects online music sitecode-projects Online Music Site Search.php sql injection6.9 Medium
- code-projects online music sitecode-projects Online Music Site AdminDeleteAlbum.php sql injection6.9 Medium
- Show moreLoading…